Manhunt in Germany After Sabotage Cuts Grid Capacity

A wave of physical attacks on German electricity infrastructure began on the morning of September 1, 2026, and has since touched three federal states. The most damaging strike hit the Amprion substation at Bergheim, west of Cologne, and briefly removed 4,200 megawatts of lignite fired capacity from the German grid. Investigators now treat the sequence as the work of a militant climate activist, and the manhunt for the suspect is still running as of September 7.

The first incident took place in southern Brandenburg. More than twenty homemade rocket devices carrying thin wire were fired at the overhead lines of the Turnow-Preilack substation, which routes output from the Jaenschwalde lignite plant operated by LEAG. Two of the devices created short circuits. Transmission operator 50Hertz reported a short interruption of service before all lines returned to normal duty, and no customer supply was lost.

The far more serious event followed the same evening. At around 20:00 CEST on September 1, conductive cable was dropped across overhead lines at the Bergheim substation. The resulting fault forced RWE to disconnect five lignite fired units at its Neurath and Niederaussem sites, an installed capacity of roughly 4,200 megawatts that was feeding about 3,000 megawatts into the system at that moment. Officers later recovered six launch devices in a neighbouring cornfield. Chief criminal director Michael Esser said the devices were built to use pyrotechnics to throw wire above the conductors. North Rhine-Westphalia interior minister Herbert Reul stated that the outage was not a failed switch but a deliberate criminal act.

The market impact was immediate. Losing three gigawatts of active generation in one step pushed transmission operators into emergency balancing. Preliminary imbalance prices for the deficit window between 20:00 and 21:00 CEST reached about 5,000 euros per megawatt hour, and intraday power traded close to 4,500 euros per megawatt hour, an unprecedented level for the German market. The system stabilised after 21:00. Three units came back on September 2, and RWE brought most of the remaining capacity back over the following days, with one unit not expected to restart until the following week. General supply, according to RWE and Amprion, was never at risk.

Two days later the campaign continued. At around 18:15 CEST on September 3, a passerby spotted suspicious objects in a field in the Gohr district of Dormagen, between Cologne and Duesseldorf, roughly 13 kilometres from the Bergheim site. Police found launch tubes fitted with timers and copper wire, similar to the equipment recovered in Bergheim and Brandenburg. The devices never fired, and investigators have not established whether a technical fault or a delayed timer setting was responsible. No damage was recorded.

The turning point in the investigation came through two claim letters sent to authorities and to media outlets including the dpa news agency and the newspaper taz. The author signed with his full name and gave a home address in Gevelsberg, in North Rhine-Westphalia, which Reul described as an extremely unusual step for this kind of case. The letters set out detailed knowledge of the attack methods and named further targets, including a substation at Weisweiler near Aachen. Reul said the texts were presumed authentic and that the stated motive was opposition to electricity generated from fossil fuels. Federal interior minister Alexander Dobrindt said on September 4 that the case had to be treated as climate extremism carried out by a lone actor, which moved the inquiry away from earlier suspicions of foreign state involvement.

Police searched the suspect's flat in Gevelsberg on September 4 and seized suspected explosive material. A special intervention unit then stormed a lorry converted into a camper, parked in woodland near Niederzier in the Hambach forest area, but the 48 year old man was not inside. On the afternoon of September 5, prosecutors and police in North Rhine-Westphalia and Brandenburg issued a joint public appeal with two photographs of the suspect, and a Europe wide arrest warrant was put in place. Investigators are also checking whether he acted alone, whether accomplices were involved, and whether any foreign or far left link exists. As of September 7 no arrest has been confirmed and the inquiries into the Jaenschwalde, Bergheim, Dormagen and Weisweiler cases remain open. Police are treating parts of the file as the formation of a terrorist organisation.

The geography of the attacks follows the German lignite map. On September 4 and 5, security services found twelve further devices near high voltage lines in eastern Saxony, south of the Baerwalde substation near Lippen and east of the Graustein substation near Schleife, both in the Lusatian mining region close to LEAG assets and the Brandenburg border. Officers also secured a transformer station at Ganderkesee in Lower Saxony and mounted a large operation at a power facility in Hamm, which turned out to be a site that had been out of service for some time. Police checked substations across several regions for further objects.

For industrial buyers the practical lesson is exposure to price shocks rather than physical shortage. German electricity supply held through every incident, but the loss of three gigawatts of baseload for a few hours was enough to send balancing costs to record levels, and any company on unhedged intraday or imbalance exposure carried that cost. Energy intensive plants in the Rhineland and Lusatia sit closest to the affected nodes. The Bundesnetzagentur confirmed earlier in the same week that it will not order coal plant closures this year under the phase out framework, which keeps lignite output relevant to German price formation through the coming winter.

Grid operators have started to argue for changed rules. Amprion chief executive Christoph Mueller told the Rheinische Post that mandatory publication of detailed network data makes attack planning too easy, and asked for narrower transparency obligations, permission to patrol lines regularly by drone, and the right to use cameras beyond company premises. Reul called for clearer legal powers and modern detection equipment such as cameras, sensors and alarm systems for critical infrastructure operators.

The context is a broader security problem. German authorities have recorded more than 165 suspected sabotage incidents since the start of 2026 and close to 750 cases of suspicious drones over military sites and critical infrastructure. On January 3 an arson attack on cables near a Berlin power station cut supply to tens of thousands of households and thousands of businesses for several days in mid winter, the longest outage in the capital since 1945. That case, claimed by a far left group, remains unsolved and carries a reward of one million euros.

Risk for the rest of September depends on whether the suspect is detained. His letters stated an intention to continue, launch equipment has already been recovered at named and unnamed sites, and operators across North Rhine-Westphalia, Brandenburg and Saxony are running inspections of exposed line corridors.